rksh is available on AIX 5.x, and it works fine with ssh and scp, however
it does not allow you to cd (including subdirectories) and doe not allow you
to run a command with a leading "/", so you can not spawn the sftp process.

It is literally with a space and -r. You don't use command line arguments in
the passwd(5) file.
[color=blue]
> Anyone have any ideas? Am I missing something stupidly simple? (and
> yes, /usr/bin/ksh *is* executable)[/color]

ls -l "/usr/bin/ksh -r"

Maybe you can make a script rksh that runs ksh -r. Some systems already have
a rksh for restricted ksh. (Check if you already have rksh.)